Reverse Engineering Beta

Questions tagged [capstone]

Ask Question

A lightweight multi-platform, multi-architecture disassembly framework.

7 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
0
votes
0answers
111 views

Capstone in reverse mode

I am using capstone in python in order to dissassemble binary instructions. Is there a way to work in the reverse mode ? I mean typing some asm instructions and ask capstone (in python) to generate ...
2
votes
1answer
660 views

Capstone: What's the purpose of the 'address' argument in cs_disasm()?

I'm trying to play around with the Capstone Disassembler in C. In the documentation they show the following use of the cs_disasm() function: from here count = cs_disasm(handle, CODE, sizeof(CODE)-1, ...
0
votes
1answer
154 views

Operand address in Capstone disassembly is not the same as in IDA/HIEW

I'm trying to disassembly x64 executable (dll) using Capstone. But operand address returned by it doesn't match disassembly from IDA/HIEW. Here is the machine code: 0x48, 0x8D, 0x0D, 0xED, 0x44, ...
1
vote
0answers
225 views

Pointer disassembly

I'm using the Capstone engine to develop an ELF disassembler. I have implemented a linear sweep algorithm as the most basic version. My goal is to implement the recursive traversal now. Consider ...
0
votes
1answer
334 views

How to DUMP the full hexa of each function extracted by analysis of binary file?

I used a script python from radare2-bindings to write a code analysing a binary file, i extracted the name , the start address and the size of each function , but i can't dump the hexa of each ...
1
vote
1answer
134 views

capstone disasm framework - check if argument read/written

I cam using the capstone disassembly framework to disassemble intel x86 code. I need to find out which operands are read to or written from (or both). According to the website, this is possible by ...
4
votes
1answer
1k views

Limitations of capstone's disassembly capabilities compared to IDA

I was wondering if there are any limitations of capstone's disassembling capabilities when compared to IDA. If yes, are those limitations inherent, i.e. a result of the different design/techniques ...